4

Imagine a table with GUIDs as primary key. I would like to select a few of these rows based on their primary key. I would like to use a query like:

SELECT * FROM mytable WHERE id IN ('firstguidhere','secondguidhere');

I am using ADO.NET to query the database, so I would like to use a parametrized query instead of dynamic sql, which would obviously work, but I want to retain the benefits of parametrized queries (security, escaping, etc...).

Is it possible to fill the collection for the IN-clause using sql-parameters?

lowglider
  • 1,087
  • 2
  • 11
  • 21
  • There's a duplicate question here somewhere... finding it... – Jon Skeet Feb 26 '09 at 10:17
  • 1
    http://stackoverflow.com/questions/337704/parameterizing-a-sql-in-clause – Jon Skeet Feb 26 '09 at 10:18
  • @Jon, The accepted answer to that question isn't really optimal, although it's a hack that I've used many times myself, and would be fine for smaller tables and/or infrequent queries. – LukeH Feb 26 '09 at 10:41
  • @jon, Thanks for pointing the other question out that out. I searched, but didn't find that question. I consider using the second answer where you generate the parametrized query dynamically. I consider this question closed. Can someone do that? – lowglider Feb 26 '09 at 10:59

1 Answers1

5

You could pass the list of GUIDs as a comma-separated string parameter and use a table-valued UDF to split them into a table to use in your IN clause:

SELECT *
FROM my_table
WHERE id IN (SELECT id FROM dbo.SplitCSVToTable(@MyCSVParam))

Erland Sommarskog has an interesting article with examples of how to split comma-separated strings into tables using a UDF.

(For performance reasons, you should ensure that your UDF is inline table-valued, rather than multi-statement.)

LukeH
  • 263,068
  • 57
  • 365
  • 409